Out of interest, do you have your site set to not return 404’s for non-existent pages?
There was a bug in earlier versions that created entries for pages that returned 404’s but a fix was released for that. I’m just wondering if you have your site set to not return a 404 (and perhaps load a search page).
I’m not sure. All three sites in question return a search page when you try to go to a non-existent page, but only one of them says “error 404, page not found.”
In general, should there be whitelist entries in the firewall for urls that don’t exist on my site or server?
I see these, too. I think they were whitelisted while WordFence Web Application Firewall was in Learning Mode. I hadn’t been to the site for a while and WF was autoupdated with the WAF in April and Learning Mode was automatically set for one week subsequent to the update. It seems there were probes for exploits common enough during the learning period that WF WAF learned them to the whitelist.
Hi all,
@shinerweb is correct that an earlier version did allow hits that generated 404s to be whitelisted, so some of the entries may be before that time — since 6.1.4, 404 hits are no longer whitelisted. If you do have a plugin that redirects 404s to another page, that may prevent this from working.
If you recognize that these don’t belong to plugins (or non-WordPress php software you have installed), then it is safe to remove them. As more attacks are identified by our research team, these will be prevented from being added to whitelists even for plugins you do have, too.
Once your site is set to “Enabled and Protecting”, no more whitelist entries will be added automatically, since they only happen in learning mode.
Let us know if you have any other questions!
-Matt R
